March and March founder Jacinta Ngobese-Zuma called June 30 something other than a shutdown. She said the state had planned for it and deployed a security apparatus costing a reported R600m. On the word itself she was right, but on the ground the effect was the same. Johannesburg’s CBD shuttered. Transport hubs went quiet. Businesses across several metros closed pre-emptively.The march itself confirmed the risk it was meant to deny. In the Johannesburg CBD, protesters confronted people they suspected of being foreign nationals. One group escaped assault only because bystanders intervened and escorted them to safety. This was not an isolated incident. Three foreign nationals were killed in the weeks before June 30. Vigilantes have evicted people from their homes in many provinces. In January, a protest outside Addington Primary School in Durban turned violent, and police used stun grenades and water cannons to disperse the crowd. A case of public violence was opened against March and March, Operation Dudula, and the MK Party.While Ngobese-Zuma’s organisation has consistently distanced itself from violence, that rhetorical distance does not extend to her position on who has authority to enforce the law. On June 8, President Cyril Ramaphosa said only authorised government officials may act against violations of the law, adding no other person is allowed to confront someone in the street to demand proof of nationality. Ngobese-Zuma rejected this directly. She insisted communities have a role to play in tackling illegal immigration, dismissing the president’s proposals as failing to address the reality on the ground. She has since gone further, calling for that role to be formalised in law. She demanded police officers and municipalities be given powers to verify immigration documents, rather than relying solely on the department of home affairs, and called for the Immigration Act, the Criminal Procedure Act and the Police Act to be amended accordingly.On July 7, Ngobese-Zuma extended this logic from a legislative demand into direct action. She issued an ultimatum threatening to take the movement’s inspections to workplaces employing undocumented foreign nationals, moving the enforcement claim from public streets into private commercial premises.This is a direct challenge to the state’s monopoly on enforcement and the use of force, not a request for administrative capacity. The state has already conceded significant ground to that challenge. By June 21, the government reported 89 criminal cases had been opened linked to public order incidents and incitement, up from 53 the week before, with 164 people arrested on charges including incitement to violence. On June 30 itself, more than 900 people were arrested nationwide, and police confirmed that while most marches were peaceful, several descended into violence. Ngobese-Zuma has also linked further mobilisation to cost. She warned that if authorities continued deploying large numbers of police officers to monitor the demonstrations, the cost to the state would keep rising. “We hope government has budget for another R600m,” she told supporters.On June 30, she set out the next phase, telling supporters the movement would march every Thursday for as long as undocumented foreign nationals remained in the country. The Centre for Risk Analysis’s (CRA) read is that the movement has institutionalised its pressure cycle. The first two Thursday marches, on July 7 in Durban and July 9 in Mthwalume, KwaZulu-Natal, confirm the cadence has held. They also show, so far, a narrower footprint than June 30. Both were KwaZulu-Natal events rather than the co-ordinated, multi-metro action seen on the shutdown date itself. That tempers — without ruling it out — the case for a formal national shutdown on the same scale within three months. The pattern to watch is whether the weekly marches stay provincial or are relaunched nationally with advance co-ordination.A separate development strengthens the CRA’s underlying argument more than the security concessions do. On July 8, Ngobese-Zuma won interim relief in the Johannesburg high court after she and two co-applicants were removed as elected immigration-sector representatives on the national dialogue steering committee. After a hearing on July 7, the government agreed the applicants could continue serving pending finalisation of formal appointment letters. This is an institutional concession and not merely a security or rhetorical one. A movement without an electoral mandate has secured, at least on an interim basis, a formal seat in a state-convened national process.The movement’s unity should not be overstated. Ngobese-Zuma has said she was excluded from Ramaphosa’s pre-march meeting with fellow activists, including Ngizwe Mchunu, and said publicly on Facebook she knew nothing of it. The split suggests the state has room to negotiate with parts of the March and March ecosystem, while others are sidelined, a fact that may blunt the movement’s coherence even as its individual components keep extracting concessions.The serious long-term risk is the precedent the state has conceded. Ngobese-Zuma’s position throughout has been unambiguous: responsibility for public order and border enforcement rests with the state, not with the movement. The government’s response, including the R600m deployment, an emergency meeting at the Union Buildings on May 26, and Ramaphosa’s pre-march meeting with movement affiliates in Durban, has functioned as institutional validation. A civic movement with no electoral mandate extracted a presidential audience and, on an interim basis, a seat in a national policy process.The threshold for compelling a state response has been reset, and other movements will have taken note. South Africa’s strained security capacity, governance bandwidth and economy will bear the cost.The counterweight is that the state’s response on June 30 was, alongside substantial private sector security support, co-ordination, communication and intelligence, more competent than the precedent of July 2021. A reported R600m in redirected operational capability produced comparatively low levels of violence and looting against a much larger mobilisation. If that operational model holds and is applied consistently, it caps the near-term security cost of the weekly cycle even as the political and institutional concessions keep accumulating. But even state capacity and bandwidth with private sector support have their limits.Hattingh is executive director at the Centre for Risk Analysis.Business Day